GHSA-q94v-v6m9-jhq9: Duplicate Advisory: OpenClaw has an improper sandbox configuration vulnerability
(updated )
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-43x4-g22p-3hrq. This link is maintained to preserve external references.
Original Description
OpenClaw versions prior to 2026.2.21 contain an improper sandbox configuration vulnerability that allows attackers to execute arbitrary code by exploiting renderer-side vulnerabilities without requiring a sandbox escape. Attackers can leverage the disabled OS-level sandbox protections in the Chromium browser container to achieve code execution on the host system.
References
- github.com/advisories/GHSA-q94v-v6m9-jhq9
- github.com/openclaw/openclaw/commit/1835dec2004fe7a62c6a7ba46b8485f124ec6199
- github.com/openclaw/openclaw/commit/e7eba01efc4c3c400e9cfd3ce3d661cbc788a631
- github.com/openclaw/openclaw/security/advisories/GHSA-43x4-g22p-3hrq
- nvd.nist.gov/vuln/detail/CVE-2026-32046
- www.vulncheck.com/advisories/openclaw-os-level-sandbox-bypass-via-no-sandbox-flag
Code Behaviors & Features
Detect and mitigate GHSA-q94v-v6m9-jhq9 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →